CrySearch Memory Scanner v1.08 - Downloads - OldSchoolHack

CrySearch Memory Scanner v1.08 Screenshot

Kategorie: Tools
Entwickler: evolution536
Hochgeladen von: KN4CK3R
Hinzugefügt am: Fr 28. Mär 2014, 17:00
System: Windows

VirusTotal Ergebnis: 0/50

Beschreibung

Bei Problemen mit einem Hack hilft
ein Blick in die FAQ!

Accessing processes remotely, also system processes when running as Administrator;
Memory scanning for primitive types, strings and byte sequences;
Filtering scan results (a.k.a. Next scan);
Creating, saving and reusing address tables containing scan results.
Changing values at memory addresses and freeze them;
Viewing PE (Portable Executable) information about the opened process;
Viewing and dumping sections;
Viewing threads, change priority, suspend, resume and create threads remotely;
Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk;
Allocating memory blocks remotely;
Generating code snippets from address tables;
Hotkeys to automate actions that do not require user input;
Viewing import address table of loaded process;
Settings hooks on the IAT of a process and restoring export addresses;
Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information;
Disassembling executable pages in a process to provide memory view and program flow control;
Walking heaps in the opened process as side feature of the disassembler;
Debugging executable code and data to find out what the flow of a program is.

Do 25. Jan 2018, 17:11
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: v3.2: - Changed the Unknowncheats forum link in about dialog to the CrySearch website (Um Links zu sehen, musst du dich registrieren); - Changes to the disassembler: - Fixed bug where not all contents of some memory page would be disassembled by Capstone; - Removed memory page selection control in favor of scrolling from page to page using up and down buttons; - Reverted back to one background thread, threadpools and multiple threads are not necessary. - Fixed bugs in memory scanner, resulting in certain ranges of memory not being searched at all; - Added description of address table entry to memory dissection window where applicable; - Added code cave scanner that identifies nop, int3 and zero sleds, accessible from the Tools menu. Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems; Scanning for code caves of variable sizes in accessible memory pages. Screenshots: Download: CrySearch Memory Scanner - v3.2

Sa 27. Mai 2017, 13:39
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: v3.0: - Slight performance optimizations by eliminating heap allocations; - Added a configurable warning (advanced tab, settings window) for when OriginalFirstThunk is zero: e.g. the application is packed; - Revised the memory scanner for performance and I/O usage: - Changed the disk storage scheme from plain value array to using a bitset and more complex data structure on disk; - Major changes for code size and speed; - Changes resulted in improved search performance, especially for larger scans. - Added a window to view all committed memory page in the target process, with the possiblity to free them (Allocate memory window); - Fixed race condition issue in the caching of search results for the user interface, keeping more results in memory than intended; - Improvements and changes to dumper plugins: - Added a first version of a dumper that dumps a module by enumerating the pages inside the process base address plus size range (needs to be perfected); - Added a signature to dumped files; the signature is placed in the NumberOfSymbols and PointerToSymbolTable fields in the PE header. - Added option (settings window, advanced tab) to show architecture of process in open process window (intrusive, turned off by default); - Added feature for brute-forcing process IDs (PID) to find possibly hidden processes. Available from Tools window: - Tries PIDs from 0 to 65535, and colors processes that were not found in the regular process list red; - Allows opening of brute-forced processes from right clicking. - Fixed a bug where CrySearch fails to retrieve the module list on opening a process that results in an infinite loop; - Some general code improvements that resulted in decreased executable file size; - Refactored hotkey system and added hotkey that toggles freeze/thaw on all address table entries; - Fixed bugs in thread hijacking method for DLL injection where: - If the opened process never communicates back that injection has finished, the injection process would enter an infinite loop; - The first thread was always selected for hijacking. A thread is randomly selected now instead for better compatibility. - Slightly adjusted the CPU information in the about window: sorted chronologically, added CPU brand string and removed VMX; - Fixed bug with routine override functions where deleting a used plugin from the plugin directory and opening the settings window subsequently would crash CrySearch; - Fixed bug where type would be changed incorrectly in the change dialog of an address table entry; - Removed the scan thread priority setting from the settings window; - Changes in the address table: - Removed the frozen parameter from persistent address table storage; - Fixed bug where freezing an address table entry would revert after a few minutes of playing. Screenshots: Download: CrySearch Memory Scanner v3.0

Mi 4. Jan 2017, 23:34
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Screenshots: Download: CrySearch Memory Scanner v2.11

Mo 17. Okt 2016, 20:06
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Screenshots: Download: CrySearch Memory Scanner v2.10

Mo 19. Sep 2016, 13:37
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Screenshots: Download: CrySearch Memory Scanner v2.05

Sa 6. Aug 2016, 02:19
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. v2.04: - Added feature to NOP out selected rows using right-click menu in the disassembly window; - Fixed a bug in the PE window where the image base of an x64 process would be truncated to 32-bits; - Fixed a bug where freezing and thawing addresses in the address table would not work properly anymore; - Added the possibility to edit multiple selected address table entries at the same time, only by right-clicking and excluding editing the address; - Reduced the timeout for retrieving window icons in the open process window; - Improved the disassembler window: - Added an option to go back to the entrypoint in the toolstrip and the right-click menu; - Added resolving of intermodular function calls to functions in the import address table; - Added heavy parallellism to the disassembler, greatly increasing processing speeds. - Added a threshold to the amount of rows that can be selected for signature or byte array generation. This threshold is set to 256; - Partially added masking for signature generation in the disassembly window. Screenshots: Download: CrySearch Memory Scanner v2.04

Fr 20. Mai 2016, 11:04
DrBlue	Cheatengine++

Do 19. Mai 2016, 15:07
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Download: CrySearch Memory Scanner v2.03

Mi 9. Mär 2016, 21:08
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table. Screenshots: Download: CrySearch Memory Scanner v2.02

Fr 27. Nov 2015, 00:17
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table. Screenshots: Download: CrySearch Memory Scanner v2.01